1

I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being exfiltrated (e.g. keylogs, screenshots, livestreams). I understand examining Wireshark logs is not trivial, but are there any obvious signs of suspicious activity one could look for? For example, could an unusual volume or frequency of outbound traffic be an indicator (and if so, what would be considered unusual)?

I realize the best course of action is to completely wipe my system, but I would like to get a better understanding of what is happening first.

Improve this question
1
  • While coming into this a little late it may be worth considering looking into a deployment of Zeek on your network in combination with that of RITA to help you identify anomalous traffic. Depending on the amount of traffic to/from that system captures in Wireshark can be tedious to dig through.
    – signus
    Commented Feb 15 at 18:43

2 Answers 2

Reset to default
0

Since you are looking at the packets, the main things to look for are:

  • unauthorised destinations
  • large sizes

Since you suspect monitoring, that doesn't require large data transfers, so you'd want to focus on the destinations to see if they are unexpected or suspicious.

There are lists of known malicious IPs that you can compare against. Or there are "threat intel" tools that can help to automate it. But either way, it's a bit of a job if you have a lot of IPs to check. But that's what you do when you have packet captures.

Improve this answer
4
  • Thank you for this thoughtful response. I suppose the destinations could still be someplace that appears benign like an AWS or Google server.
    – nooblet
    Commented Mar 6, 2023 at 0:07
  • Yes, but even some of those build up a reputation for being malicious. Packet captures only provide a small window into the problem.
    – schroeder ♦
    Commented Mar 6, 2023 at 8:53
  • Depending on who is exfiltrating data you might not even see malicious IPs. An attacker could also just piggy back on normal internet traffic.
    – secfren
    Commented Mar 6, 2023 at 15:22
  • 1
    @secfren absolutely. but then there would be little to see in the packet captures. So, when inspecting packet captures, destinations are the main thing to look for, but you only have a small window into the problem.
    – schroeder ♦
    Commented Mar 6, 2023 at 16:16
0

Without logging all destinations, all IP addresses and all processes sending data, malware could exfiltrate data undetected. And even with all monitoring in place, it would be very difficult to reliably tell that your system is clear or not.

AWS, Azure and Google Cloud are used as CDN for lots of benign sites, and for malware. Malware would encrypt its communications to not be obvious they are exfiltrating data. Don't expect to type gibberish on the keyboard and grab a packet on Wireshark containing that gibberish.

Depending on how sophisticated the malware is, it's possible to them to hijack legitimate processes to send data outside, like your browser. So you would see a connection from Firefox going to Cloudflare, and believe it's a benign connection, but it would be the malware exfiltrating your data.

And even with all monitoring in place and nothing showing as obvious monitoring data being collected, "absence of evidence is not evidence of absence." If you have reasons to believe your computer is compromised, don't waste time trying to prove yourself right or wrong.

Nuke the system, reinstall from scratch, change all passwords on all online services you care about, and then restore your backups.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .